4 ms·
Https does nothing to protect you from a compromised or evil mirror. You cannot trust https at all in this context, you need to rely on signatures.
by Xylakant 8y ago
Https does nothing to protect you from a compromised or evil mirror. You cannot trust https at all in this context, you need to rely on signatures.
- nebulous1 8y agoYou have ignored what I wrote
- ummonk 8y agoIt's astounding how many people in this thread seem to think that a compromised mirror or compromised certificate authority is somehow a comparable risk to plain old MITM.
- zaarn 8y agoIt baffles me as well. A lot of comments either seem to imply that TLS and PGP cannot coexist in a package manager or that because HTTPS doesn't protect you from Mussad replacing your phone with a brick of Uranium so you die of Cancer, the security advantage does not exist... Somehow the term "defense in depth" (aka "layers of security") has lost it's meaning.